Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
MEDIUM severity

GHSA-q9c5-pp7m-fm2g — v4

MEDIUM

GHSA-q9c5-pp7m-fm2g is a medium-severity (CVSS 5.3) CWE-862 vulnerability in github.com/fleetdm/fleet/v4. A fix is available for github.com/fleetdm/fleet/v4 — see the affected versions and patch details below.

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs

Also known asCVE-2026-101047GO-2026-6268
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 4, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-q9c5-pp7m-fm2g.

EPSS Exploitation Probability

via FIRST.org ↗
0.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs14th percentile — riskier than 14% of all scored CVEsHighest risk
0.00%0.25%0.50%0.74%0.2%0.2%Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-q9c5-pp7m-fm2g by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 382,621 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
🐹github.com/fleetdm/fleet/v4

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Two endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers.

Impact

By design, Apple's InstallEnterpriseApplication MDM command requires that the manifest URL be reachable by the managed device without a Fleet session, so these endpoints cannot enforce session-based authentication. Fleet's legacy MDM installer path mitigates this by embedding a random, hard-to-guess token in the URL; the in-house iOS app endpoints (added later) were always intended to use the same time-limited-token pattern but the mitigation was not yet in place.

The result is read-only disclosure of in-house IPA binaries and their metadata (bundle identifier, version, name) that an operator has deployed through Fleet. This is enterprise-tier only — the free tier returns fleet.ErrMissingLicense. There is no privilege escalation, write access, or impact on hosts not managed by Fleet.

Workarounds

If an immediate upgrade is not possible:

  • Restrict network access to the Fleet server to trusted networks, as is typical for MDM deployments.
  • Remove in-house iOS apps that contain sensitive material from Fleet; in-house app IPAs are intentionally reachable by managed devices and should not be relied on as a confidential distribution channel.
  • Where available, configure CloudFront URL signing for software installers to limit the validity window of issued binary URLs.

For more information

If you have any questions or comments about this advisory:

Email us at [email protected] Join #fleet in osquery Slack

Credits

We thank @offset for responsibly reporting this issue.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/fleetdm/fleet/v4all versions4.87.0go get github.com/fleetdm/fleet/v4@v4.87.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/fleetdm/fleet/v4, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/fleetdm/fleet/v4 to 4.87.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-q9c5-pp7m-fm2g is resolved across your whole dependency graph.

  3. Workarounds

    Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.

Frequently Asked Questions

### Summary Two endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers. ### Impact By design, Apple's `InstallEnterpriseApplication` MDM command requires that the manifest URL be reachable by the managed device without a Fleet session, so these endpoints cannot enforce session-based authentication. Fleet's legacy MDM installer path mitigates this by embedding a ra
O3 Security · Impact-Aware SCA

Is GHSA-q9c5-pp7m-fm2g in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
GHSA-q9c5-pp7m-fm2g: v4 — Fixed in 4.87.0 | O3 Security